Suggestion: only detect NPM modules under node_modules directory

For example, if I have a project using an NPM module called `my-module` with the following file structure:

- node_modules/
- my-module
- package.json
- src/
- index.js
- package.json

Only `my-module` should be detected as a dependency. I would expect the 2nd `package.json` to be treated as an arbitrary source file of `my-module`. I have a build task using this project to detect dependencies and it is constantly emitting warnings about a test file which happens to be named `package.json`.

Start by tracing dependency detection for package.json files under node_modules, using the example structure with my-module and its nested src/package.json. Done means only my-module is detected as a dependency and the nested package.json no longer causes warnings in the build task.

Written by the indexing model from the issue text.